About tags and aliases

In your data, you might have groups of events with related field values. To search more efficiently for these groups of event data, you can assign tags and aliases to your data.

If you tag tens of thousands of items, use field lookups. Using many tags will not affect indexing, but your search has better event categorization when using lookups. For more information on field lookups, see About lookups.

Tags

Tags enable you to assign names to specific field and value combinations, including event type, host, source, or source type.

You can use tags to help you track abstract field values, like IP addresses or ID numbers. For example, you could have an IP address related to your main office with the value 192.168.1.2. Tag that IPaddress value as mainoffice, and then search for that tag to find events with that IP address.

You can use a tag to group a set of field values together, so that you can search for them with one command. For example, you might find that you have two host names that refer to the same computer. You could give both of those values the same tag. When you search for that tag, events that involve both host name values are returned.

You can give extracted fields multiple tags that reflect different aspects of their identity, which enable you to perform tag-based searches to help you narrow the search results.

Tags example

You have an extracted field called IPaddress, which refers to the IP addresses of the data sources within your company intranet. You can tag each IP address based on its functionality or location. You can tag all of your routers' IP addresses as router, and tag each IP address based on its location, for example, SF or Building1. An IP address of a router located in San Francisco inside Building 1 could have the tags router, SF, and Building1.

To search for all routers in San Francisco that are not in Building1, use the following search.

tag=router tag=SF NOT (tag=Building1)

Tags and the search-time operations sequence

When you run a search, Splunk software runs several operations to derive knowledge objects and apply them to events returned by the search. Splunk software performs these operations in a specific sequence.

Search-time operation order

Tags come last in the sequence of search-time operations.

Restrictions

The Splunk software applies tags to field/value pairs in events in ASCII sort order. You can apply tags to any field/value pair in an event, whether it is extracted at index time, search time, or added through some other method, such as an event type, lookup, or calculated field.

For more information

Field aliases

Field aliases enable you to normalize data from multiple sources. You can add multiple aliases to a field name or use these field aliases to normalize different field names. The use of Field aliases does not rename or remove the original field name. When you alias a field, you can search for it with any of its name aliases. You can alias field names in Splunk Web or in props.conf. See Create field aliases in Splunk Web.

You can use aliases to assign different extracted field names to a single field name.

Field aliases for all source types are used in all searches, which can produce a lot of overhead over time.

Field Aliases example

One data model might have a field called http_referrer. This field might be misspelled in your source data as http_referer. Use field aliases to capture the misspelled field in your original source data and map it to the expected field name.

Field aliases and the search-time operations sequence

Search-time operations order

Field aliasing comes fourth in the search-time operations order, before calculated fields but after automatic key-value field extraction.

Restrictions

Splunk software processes field aliases belonging to a specific host, source, or sourcetype in ASCII sort order. You can create aliases for fields that are extracted at index time or search time. You cannot create aliases for fields that are added to events by search-time operations that come after the field aliasing process.

Comments

The sentence "Tags enable you to assign names to specific field and value combinations, including event type, host, source, or source type" (also appearing in the Splexicon tag entry) is also a mismatch to the https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/search, which admits only eventtypetag and hosttag. Are there missing sourcetag and sourcetypetag specifiers in SearchReference/search? Or are we supposed to search for e.g. tag::source=<value>?

DUThibault

May 22, 2019

The specification for tags in https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/search is quite different from that given in the "Tags example" here. Specifically:
"To search for all routers in San Francisco that are not in Building1, use the following search.
tag=router tag=SF NOT (tag=Building1)"
Now all tags mentioned here are added to the IPaddress field, so the search should be (correct me if I'm wrong):
tag::IPaddress=router tag::IPaddress=SF NOT (tag::IPaddress=Building1)
Of course it might be more efficient to tag the hosts in this instance, so the search becomes:
hosttag=router hosttag=SF NOT (hosttag=Building1)
It would be more useful to have an example that shows all three types of tags at work: hosttag, eventtypetag, and tag::<field>.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »